FraudBuster: Temporal Analysis and Detection of Advanced Financial Frauds

Abstract

Modern financial frauds are frequently automated through specialized malware that hijacks money transfers from the victim's computer. An insidious type of fraud consists in repeatedly stealing small amounts of funds over time. A reliable detection of these fraud schemes requires an accurate modeling of the user's spending pattern over time. In this paper, we propose FraudBuster, a framework that exploits the end user's recurrent vs. non-recurrent spending pattern to detect these sophisticated frauds. FraudBuster is based on a learning stage that builds, for each user, temporal profiles and quantifies the deviation of each incoming transaction from the learned model. The final output is the aggregated score that quantifies the risk of a user of being defrauded. In this setting, FraudBuster detects frauds as transactions that are not simply "anomalous", but that would change the user's spending profile. We deployed FraudBuster in the real-world setting of a national banking group and measured the detection performance, showing that it can outperform existing solutions. positives due to legitimate, small-amount, recurrent transfers (e.g., subscriptions). The detection task is challenging because frauds are dynamic and "blend in" with legitimate transactions. Furthermore, the scarcity of publicly available, real-world datasets makes research in this area a daunting task. Our state-of-theart analysis revealed that existing works presume the existence of periodicities in users' spending patterns, without verifying it on real data. In this paper, we propose FraudBuster, a fraud-analysis system that aims to detect salami-slicing frauds by exploiting a precise modeling of recurrent vs. non-recurrent spending patterns. FraudBuster is based on a learning stage that automatically estimates the end user's temporal profiles by means of historical (and likely fraud-free) spending patterns and quantifies the deviation of the current user's spending profile from the learned model. In particular, we apply signal processing techniques to extract temporal patterns "hidden" in the time series obtained from the transaction history. We show that temporal patterns exist, and thus a fraud-detection technique augmented by temporal-pattern classification is more effective than conventional detection approaches. First, Fraud-Buster classify each user based on its spending pattern. Then if a user is labeled as "periodic" (i.e., his or hers spending patter is characterized by periodicity), FraudBuster aligns and averages the observed time series to create a reference pattern model. In other words, we derive the most likely spending activity. Small deviations from strict periodic pattern are accounted by the dynamic time warping (DTW) algorithm [4] that is adapted here to measure the similarity between two temporal sequences up to a small deviation from the reference pattern. For both users with and without periodic spending patterns, FraudBuster uses a proper time-windowing analysis of transactions. For each incoming transaction, FraudBuster ...

Fraud detection with natural language processing

“…They mainly utilize anomaly detection methods to build user-specific behavioral profiles with respect to their transaction history, without using any sequential information. In another paper, Michele Carminati et al (2018) propose a framework called FraudBuster for detecting financial frauds that involve stealing small amounts of funds over time. Their framework models the user's spending pattern over time and detects frauds as transactions that deviate from the learned model and change the user's spending profile.…”

“…For instance, they cannot adapt to evolving fraud patterns without human intervention and require domain experts to engineer and update features. Fraud detection solutions that are based on machine (Lucas 2019;Patel et al 2019;Wang et al 2017;Mehana 2020) and deep (Carminati et al 2018;Achituve et al 2019) learning do not suffer from these drawbacks, however, they have only been investigated on top of features that require heavy engineering to be extracted. For example, in Baesens et al (2021), the authors fit a von Mises distribution on the timestamps of each user's transactions to construct confidence intervals for the time periods that transactions generally take place for each user.…”

Analysis and Consideration of Detection Methods to Prevent Fraudulent Access by Utilizing Attribute Information and the Access Log History

“…Michele et al proposed BANKSEALER and FRAUDBUSTER as systems specializing in the detection of illegal money transfer for banks [17], [18]. These systems detect abnormalities by profiling the patterns of consumption behavior of users on the Internet banking system.…”

Amaretto: An Active Learning Framework for Money Laundering Detection

“…BankSealer [15], [16] works in an unsupervised setting, extracting local, global, and temporal profiles [17] for each user to capture their behaviors. The same authors also study the security of fraud detection systems against mimicry and adversarial attacks [18], [19].…”

“…The aggregation windows have the objective of capturing the short-term, mid-term, and long-term behavior of the user. We look for the most used sizes in literature [17], [37]: We use 1 hour and 1 day for the short-term, 7 days for the mid-term, Finally, the two aggregations, Amount_IO_Aggregation and Product_Currency_Aggregation, are merged and indexed using the Originator and the temporal columns. This is the final high-level vector used to train or analyzed by the Anomaly Detection Module.…”